Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

4f9a19f345...bN.exe

windows7-x64

10

4f9a19f345...bN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4f9a19f345a01e4b66bb37bf2fbf92d35775e540a52ddb9f46867ecc90ef822bN

  • Size

    256KB

  • Sample

    241015-bfm9rswaqg

  • MD5

    d35413c6121fc8a1b5790f26fe0d2c10

  • SHA1

    29849c52b61f5579438798cad695eb148f94f602

  • SHA256

    4f9a19f345a01e4b66bb37bf2fbf92d35775e540a52ddb9f46867ecc90ef822b

  • SHA512

    5cee12486e77446bf487cd2bfb2a2b4ea55f3a88dff79bb424c738de5bd1bc16778b33fb4ffab036cf3e26b98a17861e68b4e5c3bb92f6d695e8fa0bc002ddfe

  • SSDEEP

    6144:f7Blt7EB5Zi/GOORjMmRUoooooooooooooooooooooooooy/G:fVrEB/i//OVLCooooooooooooooooooN

Score
10/10
berbewbackdoordiscoverypersistence

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Targets

    • Target

      4f9a19f345a01e4b66bb37bf2fbf92d35775e540a52ddb9f46867ecc90ef822bN

    • Size

      256KB

    • MD5

      d35413c6121fc8a1b5790f26fe0d2c10

    • SHA1

      29849c52b61f5579438798cad695eb148f94f602

    • SHA256

      4f9a19f345a01e4b66bb37bf2fbf92d35775e540a52ddb9f46867ecc90ef822b

    • SHA512

      5cee12486e77446bf487cd2bfb2a2b4ea55f3a88dff79bb424c738de5bd1bc16778b33fb4ffab036cf3e26b98a17861e68b4e5c3bb92f6d695e8fa0bc002ddfe

    • SSDEEP

      6144:f7Blt7EB5Zi/GOORjMmRUoooooooooooooooooooooooooy/G:fVrEB/i//OVLCooooooooooooooooooN

    Score
    10/10
    berbewbackdoordiscoverypersistence

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Berbew

      Berbew is a backdoor written in C++.

      backdoorberbew

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks